Lead Incident Command & Cross-Functional Response

EY; Austin (TX); On-site; USD 104,800 - 192,200; Full time

Job summary

EY is seeking a Lead Incident Response Coordinator who will be the central point of coordination for operational, cybersecurity, infrastructure, connectivity, monitoring, and service-impacting incidents.

You will lead incident command activities, manage cross-functional response coordination, drive escalation and stakeholder communications, track restoration actions, and support post-incident review and continuous improvement.

Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, Engineering, Business, or equivalent experience preferred.
• 6+ years of experience in incident management, operations coordination, cybersecurity operations, infrastructure operations, service management, or technical delivery roles.
• Strong communication, facilitation, documentation, prioritization, and decision-support skills.
• Ability to coordinate technical teams without directly performing all technical remediation activities.
• Experience coordinating incidents, escalations, major operational events, or cross-functional response activities.
• Experience with incident command and ITIL processes is preferred.

Responsibilities

• Incident Command and Coordination: Serve as the lead coordinator for incidents and major operational events requiring cross-functional response.
• Establish incident command structure, response rhythm, and clear ownership during active incidents.
• Coordinate response activities across technical, operational, cybersecurity, vendor, and stakeholder teams.
• Assign, confirm, and track incident actions through restoration and closure.
• Ensure response activities remain aligned to incident priority, business impact, and restoration objectives.
• Escalation Management: Evaluate incident severity, operational impact, and escalation requirements.
• Coordinate engagement of appropriate technical specialists, support teams, vendors, and leadership stakeholders.
• Escalate unresolved issues, critical blockers, and material operational risks through the appropriate channels.
• Facilitate rapid decision-making when response efforts require prioritization, ownership clarification, or leadership engagement.
• Maintain clear visibility into escalation status, response ownership, and unresolved dependencies.
• Communications Management: Develop and coordinate clear incident communications for response teams, leadership, and impacted stakeholders.
• Maintain stakeholder awareness throughout the incident lifecycle, including status, impact, actions, blockers, and recovery progress.
• Coordinate communication cadence during high-priority incidents and ensure updates are accurate, consistent, and actionable.
• Support business, site, customer, or leadership communications where required.
• Ensure incident communications remain factual, concise, and aligned to approved response practices.
• Resolution Tracking and Recovery Management: Maintain incident action logs, decision records, recovery tasks, dependencies, and blockers.
• Drive accountability across participating response teams and ensure assigned actions are tracked to completion.
• Validate restoration criteria, recovery milestones, and transition back to normal operations.
• Coordinate closure activities and ensure incident records accurately reflect the response timeline and outcome.
• Support handoff from active incident response into remediation, problem management, or continuous improvement activities.
• Cross-Team Operational Leadership: Coordinate incident response across monitoring, network, infrastructure, cybersecurity, endpoint, platform, application, vendor, and site support teams.
• Promote consistent incident handling practices across service domains and operational teams.
• Help remove response friction by clarifying ownership, next actions, decision points, and escalation paths.
• Support operational readiness exercises, incident simulations, and tabletop activities as needed.
• Build familiarity with service dependencies, support models, escalation paths, and response expectations.

Skills

Incident coordination

Cross-team collaboration

Communication

Stakeholder management

Decision-support

Education

Bachelor's degree in Information Technology, Cybersecurity, Engineering, Business, or equivalent experience

6+ years of incident management experience

Job description

EY is seeking a Lead Incident Response Coordinator who will be the central point of coordination for operational, cybersecurity, infrastructure, connectivity, monitoring, and service-impacting incidents.

You will lead incident command activities, manage cross-functional response coordination, drive escalation and stakeholder communications, track restoration actions, and support post-incident review and continuous improvement.